CVE-2026-109613: falha de alta gravidade em frappe erpnext
Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
frappe · erpnextCVEs relacionadas — frappe erpnext
No mesmo produto, das mais perigosas para as menos.
CVE-2026-65974CRITICALERPNext: Server-Side Template Injection leading to Remote Code ExecutionEPSS 1.0%CVE-2026-72911CRITICALERPNext: Possibility of server-side template injection due to missing validationEPSS 0.7%CVE-2026-72908MEDIUMERPNext: Possibility of SQL injection due to missing validationEPSS 0.5%CVE-2026-72910HIGHERPNext: Unauthorised modification of master data due to missing validationEPSS 0.5%CVE-2026-72909HIGHERPNext: Broken Access Control on certain endpointsEPSS 0.5%CVE-2026-65822HIGHERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterEPSS 0.5%